CVE-2018-11646
HighPublic exploitwebkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase.cpp in WebKit, as used in WebKitGTK+ through 2.21.3, mishandle an unset pageURL, leading to an application crash.
Published Jun 1, 2018 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2018-11646, SUSE-SU-2018:2075-1, UBUNTU-CVE-2018-11646
Key Facts
Patch immediately- CVE-2018-11646 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Webkitgtk\+, webkit2gtk (debian), qtwebkit-opensource-src (ubuntu) and 16 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 68% probability of exploitation in the next 30 days.
- Fixed versions are available, including libjavascriptcoregtk-4_0-18 2.20.3-11.1, libjavascriptcoregtk-4_0-18 2.20.3-2.23.8, libjavascriptcoregtk-4_0-18 2.20.3-3.3.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
68%
Higher than 99.3% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2018-11646 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase.cpp in WebKit, as used in WebKitGTK+ through 2.21.3, mishandle an unset pageURL, leading to an application crash.
Affected Products
94 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Webkitgtk\+Webkitgtk | See advisory | 2.21.3 |
| webkit2gtkdebian | See advisory | 2.20.3-1 |
| qtwebkit-opensource-srcubuntu | See advisory | n/a |
| qtwebkit-sourceubuntu | See advisory | n/a |
| webkitgtkubuntu | See advisory | n/a |
Patched Releases
libjavascriptcoregtk-4_0-18
2.20.3-11.1, 2.20.3-2.23.8, 2.20.3-3.3.1, 2.20.3-lp150.2.3.1, 2.32.4-1.1
libjavascriptcoregtk-4_0-18-32bit
2.20.3-11.1, 2.20.3-lp150.2.3.1, 2.32.4-1.1
libwebkit2gtk-4_0-37
2.20.3-11.1, 2.20.3-2.23.8, 2.20.3-3.3.1, 2.20.3-lp150.2.3.1, 2.32.4-1.1
libwebkit2gtk-4_0-37-32bit
2.20.3-11.1, 2.20.3-lp150.2.3.1, 2.32.4-1.1
libwebkit2gtk3-lang
2.20.3-11.1, 2.20.3-2.23.8, 2.20.3-3.3.1, 2.20.3-lp150.2.3.1, 2.32.4-1.1
typelib-1_0-JavaScriptCore-4_0
2.20.3-11.1, 2.20.3-2.23.8, 2.20.3-3.3.1, 2.20.3-lp150.2.3.1, 2.32.4-1.1
typelib-1_0-WebKit2-4_0
2.20.3-11.1, 2.20.3-2.23.8, 2.20.3-3.3.1, 2.20.3-lp150.2.3.1, 2.32.4-1.1
typelib-1_0-WebKit2WebExtension-4_0
2.20.3-11.1, 2.20.3-2.23.8, 2.20.3-3.3.1, 2.20.3-lp150.2.3.1, 2.32.4-1.1
webkit-jsc-4
2.20.3-11.1, 2.20.3-lp150.2.3.1, 2.32.4-1.1
webkit2gtk
2.20.1-0ubuntu0.16.04.1, 2.20.3-1
webkit2gtk-4_0-injected-bundles
2.20.3-11.1, 2.20.3-2.23.8, 2.20.3-3.3.1, 2.20.3-lp150.2.3.1, 2.32.4-1.1
webkit2gtk3
2.20.3-11.1, 2.20.3-2.23.8, 2.20.3-3.3.1, 2.20.3-lp150.2.3.1
webkit2gtk3-devel
2.20.3-11.1, 2.20.3-2.23.8, 2.20.3-3.3.1, 2.20.3-lp150.2.3.1, 2.32.4-1.1
webkit2gtk3-minibrowser
2.32.4-1.1
webkit2gtk3-plugin-process-gtk2
2.20.3-11.1, 2.20.3-lp150.2.3.1
Webkitgtk\+
<=2.21.3
Timeline
Publicly disclosed
Jun 1, 2018
Last updated
Aug 4, 2026
References
- advisoryhttps://bugzilla.suse.com/1075775
- advisoryhttps://bugzilla.suse.com/1077535
- advisoryhttps://bugzilla.suse.com/1079512
- advisoryhttps://bugzilla.suse.com/1088182
- advisoryhttps://bugzilla.suse.com/1088932
FAQ
Common Questions.
webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase.cpp in WebKit, as used in WebKitGTK+ through 2.21.3, mishandle an unset pageURL, leading to an application crash.
Affected: Webkitgtk\+; webkit2gtk (debian); qtwebkit-opensource-src (ubuntu), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including libjavascriptcoregtk-4_0-18 2.20.3-11.1, libjavascriptcoregtk-4_0-18 2.20.3-2.23.8, libjavascriptcoregtk-4_0-18 2.20.3-3.3.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2018-11646 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo